Cybersecurity researchers at Huntress have raised the alarm about a fast-moving device code phishing campaign that is actively targeting Microsoft 365 accounts across more than 340 organizations.
A bunch of ads started campaigning on Feb 19, 2026 and they are getting fast at a quicker rate now. They've been penetrating different industries including construction, non-profit, real estate, manufacturing, financial services, healthcare, the law, and government, mostly throughout United States, Canada, Australia, New Zealand, and Germany.
Furthermore, the most remarkable thing about this campaign is its very ingenious way of combining multiple types of techniques. Attackers are using construction bid lures, DocuSign impersonation, voicemail notifications, and even abused Microsoft Forms pages, all funneling victims toward the same infrastructure hosted on Railway (a popular Platform-as-a-Service).
Device code phishing is the main method for carrying out the attack using Microsoft’s official OAuth device authorization flow. The attack works as follows:
1. The attacker uses the Microsoft Entra ID API to get a device code.
2. A hacker will create a fake phishing which includes a link to the actual Microsoft device login page (microsoft.com/devicelogin) where the user is instructed to enter their device code and log in with their username/password as well as enter a 2nd Verification Code.
3. After authenticating, Microsoft issues access token and refresh tokens for the supplied device code.
4. Because the attacker is aware of the original device code, they can use those tokens to maintain ongoing access to the victim’s account, even if the password is changed.
The reason that this method is so effective is that it takes advantage of Microsoft’s legitimate infrastructure and, therefore, appears completely legitimate to the end user as well as many of the standard security tools used to evaluate the login process.
In this specific instance, automated processes have been put in place by the attacker to assist with parts of the attack. Victims are taken to landing pages (often hosted on Cloudflare Workers) that automatically display the device code and provide a “Continue to Microsoft” button. Clicking it opens the real Microsoft login page in a pop-up, lowering suspicion even further.
Phishing emails utilize legitimate redirection services of security vendors like Trend Micro, Cisco and Mimecast for a very clever way to hide the malicious URLs. They use these to get around other spam filters.
Huntress has linked most of the activity to a small group of Railway IP addresses. Three of those IP addresses were responsible for most of the events Huntress observed. The campaign has been found to be associated with a new Phishing-as-a-Service (PhaaS) called EvilTokens seen on Telegram last month. EvilTokens offers customers ready-made tools, open redirect links, spam bypass features, and even 24/7 support.
Palo Alto Networks Unit 42 has seen similar device code phishing campaigns and attackers utilizing anti-analysis measures (disabling right click, blocking development tools, and putting infinite loops in debuggers) to interfere with the investigation.
Recommendations
1. Closely monitor Microsoft 365 sign-in logs for any sign-ins from a Railway IP address.
2. If you find something suspicious, immediately revoke all refresh tokens for the impacted user.
3. Where feasible, consider blocking authentication attempts from known Railway infrastructure.
4. Educate your users that entering a device code on microsoft.com/devicelogin should only take place if they initiated the request from their device by themselves.
Device code phishing continues to evolve and remains one of the more effective ways to bypass traditional MFA protections. With this campaign actively hitting hundreds of organizations, now is a good time to review your sign-in logs and reinforce awareness around unusual Microsoft login prompts.
Stay vigilant, a single well-crafted email can still open the door if users aren’t sure what to watch for.
Source: The Hacker News
